From 4b9c533b9495531ff2aa94dd4f061780a44aaf0b Mon Sep 17 00:00:00 2001 From: Aaron Hurt Date: Fri, 31 Aug 2018 11:30:00 -0500 Subject: [PATCH 1/2] add the ability to skip creation of MASQUERADE rules via iptables when executing `weave expose` command --- .gitignore | 3 +++ net/bridge.go | 2 +- net/expose.go | 9 ++++++--- prog/weaver/main.go | 2 +- router/http.go | 13 +++++++++++-- weave | 28 ++++++++++++++++++++-------- 6 files changed, 42 insertions(+), 15 deletions(-) diff --git a/.gitignore b/.gitignore index e2d07310..e3fea5bc 100644 --- a/.gitignore +++ b/.gitignore @@ -36,6 +36,9 @@ coverage.html # Sed backup files *.bak +# JetBrains/GoLand/IntelliJ project file +.idea + # Project specific prog/weaver/weaver prog/weavedns/weavedns diff --git a/net/bridge.go b/net/bridge.go index e6fb747c..d9a33c8a 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -602,7 +602,7 @@ func reexpose(config *BridgeConfig, log *logrus.Logger) error { for _, addr := range addrs { log.Infof("Re-exposing %s on bridge %q", addr.IPNet, config.WeaveBridgeName) - if err := Expose(config.WeaveBridgeName, addr.IPNet, config.AWSVPC, config.NPC); err != nil { + if err := Expose(config.WeaveBridgeName, addr.IPNet, config.AWSVPC, config.NPC, false); err != nil { return errors.Wrapf(err, "unable to re-expose %s on bridge: %q", addr.IPNet, config.WeaveBridgeName) } } diff --git a/net/expose.go b/net/expose.go index 97edecbf..76ba41a1 100644 --- a/net/expose.go +++ b/net/expose.go @@ -18,7 +18,8 @@ import ( // * "ipAddr" - IP addr to be assigned to the bridge. // * "removeDefaultRoute" - whether to remove a default route installed by the kernel (used only in the AWSVPC mode). // * "npc" - whether is Weave NPC running. -func Expose(bridgeName string, ipAddr *net.IPNet, removeDefaultRoute, npc bool) error { +// * "skipNAT" - whether to skip adding iptables NAT rules +func Expose(bridgeName string, ipAddr *net.IPNet, removeDefaultRoute, npc bool, skipNAT bool) error { ipt, err := iptables.New() if err != nil { return errors.Wrap(err, "iptables.New") @@ -29,8 +30,10 @@ func Expose(bridgeName string, ipAddr *net.IPNet, removeDefaultRoute, npc bool) return errors.Wrap(err, "addBridgeIPAddr") } - if err := exposeNAT(ipt, cidr); err != nil { - return errors.Wrap(err, "exposeNAT") + if !skipNAT { + if err := exposeNAT(ipt, cidr); err != nil { + return errors.Wrap(err, "exposeNAT") + } } if !npc { diff --git a/prog/weaver/main.go b/prog/weaver/main.go index 79c1b65a..22e0ca23 100644 --- a/prog/weaver/main.go +++ b/prog/weaver/main.go @@ -513,7 +513,7 @@ func exposeForAWSVPC(alloc *ipam.Allocator, subnet address.CIDR, bridgeName stri addr, err := alloc.Allocate("weave:expose", subnet, false, func() bool { return false }) checkFatal(err) cidr := address.MakeCIDR(subnet, addr) - err = weavenet.Expose(bridgeName, cidr.IPNet(), true, false) + err = weavenet.Expose(bridgeName, cidr.IPNet(), true, false, false) checkFatal(err) Log.Printf("Bridge %q exposed on address %v", bridgeName, cidr) ready() diff --git a/router/http.go b/router/http.go index 88e66ca2..ff6bb2de 100644 --- a/router/http.go +++ b/router/http.go @@ -3,6 +3,7 @@ package router import ( "fmt" "net/http" + "strconv" "github.com/gorilla/mux" @@ -29,15 +30,23 @@ func (router *NetworkRouter) HandleHTTP(muxRouter *mux.Router) { router.ForgetConnections(r.Form["peer"]) }) - muxRouter.Methods("POST").Path("/expose/{ip}/{prefixlen}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + muxRouter.Methods("POST").Path("/expose/{ip}/{prefixlen}/{skipNAT}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) { vars := mux.Vars(r) + var skipNAT bool cidr, err := address.ParseCIDR(vars["ip"] + "/" + vars["prefixlen"]) if err != nil { http.Error(w, fmt.Sprint("unable to parse ip addr: ", err.Error()), http.StatusBadRequest) return } - if err = net.Expose(router.BridgeConfig.WeaveBridgeName, cidr.IPNet(), router.BridgeConfig.AWSVPC, router.BridgeConfig.NPC); err != nil { + if vars["skipNAT"] != "" { + skipNAT, err = strconv.ParseBool(vars["skipNAT"]) + if err != nil { + http.Error(w, fmt.Sprint("unable to parse skipNAT option: ", err.Error()), http.StatusBadRequest) + } + } + + if err = net.Expose(router.BridgeConfig.WeaveBridgeName, cidr.IPNet(), router.BridgeConfig.AWSVPC, router.BridgeConfig.NPC, skipNAT); err != nil { http.Error(w, fmt.Sprint("unable to expose: ", err.Error()), http.StatusInternalServerError) return } diff --git a/weave b/weave index ad7d4167..08a37607 100755 --- a/weave +++ b/weave @@ -69,7 +69,7 @@ weave attach [--without-dns] [--rewrite-hosts] [--no-multicast-route] [ ...] detach [ ...] -weave expose [ ...] [-h ] +weave expose [ ...] [-h ] [--without-masquerade] hide [ ...] weave dns-add [ ...] [-h ] | @@ -430,9 +430,10 @@ EOF } expose_ip() { + [ -z $WITHOUT_MASQUERADE ] || skipNAT="/true" ipam_cidrs allocate_no_check_alive weave:expose $CIDR_ARGS for CIDR in $ALL_CIDRS ; do - call_weave "POST" "/expose/$CIDR" + call_weave "POST" "/expose/$CIDR$skipNAT" [ -z "$FQDN" ] || when_weave_running put_dns_fqdn_no_check_alive weave:expose $FQDN $CIDR done @@ -1475,14 +1476,25 @@ case "$COMMAND" in dig @$DOCKER_BRIDGE_IP +short $1 ;; expose) + WITHOUT_MASQUERADE= + FQDN= collect_cidr_args "$@" shift $CIDR_ARG_COUNT - if [ $# -eq 0 ] ; then - FQDN="" - else - [ $# -eq 2 -a "$1" = "-h" ] || usage - FQDN="$2" - fi + while [ $# -gt 0 ]; do + case "$1" in + -h) + [ -z $FQDN ] && FQDN=$2 && shift || usage + ;; + --without-masquerade) + WITHOUT_MASQUERADE=1 + ;; + *) + break + ;; + esac + shift + done + [ $# -eq 0 ] || usage expose_ip show_addrs $ALL_CIDRS ;; From c9f1d30f499a17b010a98182c961cd8bbf63a907 Mon Sep 17 00:00:00 2001 From: Aaron Hurt Date: Fri, 31 Aug 2018 14:24:16 -0500 Subject: [PATCH 2/2] updates to address comments by @bboreham --- .gitignore | 3 --- router/http.go | 9 ++++----- weave | 2 +- 3 files changed, 5 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index e3fea5bc..e2d07310 100644 --- a/.gitignore +++ b/.gitignore @@ -36,9 +36,6 @@ coverage.html # Sed backup files *.bak -# JetBrains/GoLand/IntelliJ project file -.idea - # Project specific prog/weaver/weaver prog/weavedns/weavedns diff --git a/router/http.go b/router/http.go index ff6bb2de..0f014956 100644 --- a/router/http.go +++ b/router/http.go @@ -30,18 +30,17 @@ func (router *NetworkRouter) HandleHTTP(muxRouter *mux.Router) { router.ForgetConnections(r.Form["peer"]) }) - muxRouter.Methods("POST").Path("/expose/{ip}/{prefixlen}/{skipNAT}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + muxRouter.Methods("POST").Path("/expose/{ip}/{prefixlen}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) { vars := mux.Vars(r) - var skipNAT bool cidr, err := address.ParseCIDR(vars["ip"] + "/" + vars["prefixlen"]) if err != nil { http.Error(w, fmt.Sprint("unable to parse ip addr: ", err.Error()), http.StatusBadRequest) return } - if vars["skipNAT"] != "" { - skipNAT, err = strconv.ParseBool(vars["skipNAT"]) - if err != nil { + var skipNAT bool + if r.FormValue("skipNAT") != "" { + if skipNAT, err = strconv.ParseBool(r.FormValue("skipNAT")); err != nil { http.Error(w, fmt.Sprint("unable to parse skipNAT option: ", err.Error()), http.StatusBadRequest) } } diff --git a/weave b/weave index 08a37607..a8463ffc 100755 --- a/weave +++ b/weave @@ -430,7 +430,7 @@ EOF } expose_ip() { - [ -z $WITHOUT_MASQUERADE ] || skipNAT="/true" + [ -z $WITHOUT_MASQUERADE ] || skipNAT="?skipNAT=true" ipam_cidrs allocate_no_check_alive weave:expose $CIDR_ARGS for CIDR in $ALL_CIDRS ; do call_weave "POST" "/expose/$CIDR$skipNAT"